Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

My website is infected with iframe injection and some javascript virus.

There is some JS code which is present in all the files.

Is there any way that i can paste that JS code in a text file and make shell script which matches that pattern and rmoves from the pages

I have vps server centos with cpanel whm

share|improve this question

marked as duplicate by HopelessN00b Jan 14 '15 at 0:24

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

The question "my site/server has been hacked/infected" comes up all the time, the answer is always the same: "Wipe the server, restore from known-good backups" – Chris S Jun 24 '10 at 12:47
See the somewhat related question… – Zoredache Jun 28 '10 at 1:22

If the site is infected it would be safer to replace everything from a clean backup - and that includes any databases you might have.

While it probably is possible there's a good chance you'll miss something and not have a fully clean site.

You should also try and work out where the infection came from - probably an insecure ftp account - and close that loophole before proceeding.

share|improve this answer
the problem is i don't have backup at all , what should i do – John Jun 24 '10 at 13:06
is there any scanner available for website which can delete the malaciou code via ftp – John Jun 24 '10 at 13:08